From 16fd22b32e38e332af8199cb3b9e3f801ad324a1 Mon Sep 17 00:00:00 2001
From: Omkar Tripathi <38633467+triggeredcode@users.noreply.github.com>
Date: Mon, 12 Oct 2026 16:41:31 +0530
Subject: [PATCH] chore: the licence notices are made when the app is packaged,
 not kept in the repository

THIRD_PARTY_NOTICES.md is a generated list of the 280 packages bundled into the app. The licences of what is bundled ask for
it to travel with the app, so it stays in the app (Help, Licences of the Software Lucid Uses), but it does not have to sit in
the repository root and be kept up to date by a CI check. `prepack` now writes it, and afterPack still refuses an app without it.
The script runs pnpm from the repository root, and through a shell on Windows.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml      |   1 -
 .github/workflows/release.yml |   1 +
 .gitignore                    |   2 +
 README.md                     |   3 +-
 THIRD_PARTY_NOTICES.md        | 336 ----------------------------------
 apps/desktop/package.json     |   2 +-
 package.json                  |   1 -
 scripts/notices.mjs           |  30 +--
 site/index.html               |   4 +-
 9 files changed, 17 insertions(+), 363 deletions(-)
 delete mode 100644 THIRD_PARTY_NOTICES.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ad169f0..e83cd0a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,6 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm lint
       - run: pnpm format:check
-      - run: pnpm notices:check
 
   test:
     name: Unit tests (${{ matrix.name }})
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e8ec89f..e1c11f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,7 @@ on:
       - "apps/desktop/scripts/**"
       - "apps/desktop/e2e-packaged/**"
       - "scripts/fetch-tectonic.mjs"
+      - "scripts/notices.mjs"
       - ".github/workflows/release.yml"
   # Run by hand from a branch to try the same without a pull request.
   workflow_dispatch:
diff --git a/.gitignore b/.gitignore
index b2d6c31..d0ea37f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,8 @@ dist/
 out/
 build/
 coverage/
+# made when the app is packaged (scripts/notices.mjs)
+/THIRD_PARTY_NOTICES.md
 *.tsbuildinfo
 
 # OS / editor
diff --git a/README.md b/README.md
index 77b2b5c..ce719dd 100644
--- a/README.md
+++ b/README.md
@@ -278,6 +278,7 @@ described in [`SECURITY.md`](SECURITY.md). Changes are listed in [`CHANGELOG.md`
 
 ## Licence
 
-[MIT](LICENSE). Lucid is built on open-source software; see [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md). Special thanks
+[MIT](LICENSE). Lucid is built on open-source software; the list of what it bundles and their licences comes with the app
+(Help, Licences of the Software Lucid Uses). Special thanks
 to [BlockNote](https://www.blocknotejs.org), [Mermaid](https://mermaid.js.org), [Tectonic](https://tectonic-typesetting.github.io),
 [Electron](https://www.electronjs.org) and [iA Writer Mono](https://github.com/iaolo/iA-Fonts).
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
deleted file mode 100644
index b005b58..0000000
--- a/THIRD_PARTY_NOTICES.md
+++ /dev/null
@@ -1,336 +0,0 @@
-# Third-party notices
-
-Lucid is built on open-source software. The packages below are bundled into the app (production dependencies of the desktop
-app and the MCP server). Each is under the license shown; the full license texts are in each package's folder in
-`node_modules`. Generated by `node scripts/notices.mjs`; do not edit by hand.
-
-## Notes
-
-- **MPL-2.0** (BlockNote: `@blocknote/core`, `@blocknote/mantine`, `@blocknote/react`): used unmodified as libraries. Its
-  source is at https://github.com/TypeCellOS/BlockNote. Lucid does not use BlockNote's `xl-*` packages (GPL or commercial).
-- **EPL-2.0** (`elkjs`, the graph layout engine behind Mermaid's ELK layout): used unmodified; source at https://github.com/kieler/elkjs.
-- **Tectonic** (MIT, https://tectonic-typesetting.github.io), the PDF engine, comes with the app as a separate program
-  (`Contents/Resources/bin/tectonic`), unmodified. The TeX support files it downloads the first time it makes a PDF come from
-  Tectonic's own bundle (the TeX Live distribution, under its various free licenses).
-- **Electron and Chromium** (MIT and BSD-style licenses, https://www.electronjs.org): the app's runtime. Their license texts are
-  in the app (`Contents/Resources/LICENSE` and `Contents/Resources/LICENSES.chromium.html`).
-- **LM Studio** is a separate application, not part of Lucid, that serves the language model.
-- Lucid's own code never copies from GPL projects (VoiceInk, whisper-writer).
-
-## Packages (280)
-
-### (MIT OR CC0-1.0) (1)
-
-- type-fest 5.10.0 — https://github.com/sindresorhus/type-fest#readme
-
-### (MPL-2.0 OR Apache-2.0) (1)
-
-- dompurify 3.4.16 — https://github.com/cure53/DOMPurify
-
-### 0BSD (1)
-
-- tslib 2.8.1 — https://www.typescriptlang.org/
-
-### Apache-2.0 (6)
-
-- @chevrotain/cst-dts-gen 13.2.0 — https://github.com/Chevrotain/chevrotain#readme
-- @chevrotain/gast 13.2.0 — https://github.com/Chevrotain/chevrotain#readme
-- @chevrotain/regexp-to-ast 13.2.0 — https://github.com/Chevrotain/chevrotain#readme
-- @chevrotain/types 13.2.0 — https://chevrotain.io/documentation/
-- @chevrotain/utils 13.2.0 — https://github.com/Chevrotain/chevrotain#readme
-- chevrotain 13.2.0 — https://chevrotain.io/docs/
-
-### BSD-2-Clause (1)
-
-- json-schema-typed 8.0.2 — https://github.com/RemyRylan/json-schema-typed/tree/main/dist/node
-
-### BSD-3-Clause (8)
-
-- d3-array 2.12.1 — https://d3js.org/d3-array/
-- d3-ease 3.0.1 — https://d3js.org/d3-ease/
-- d3-path 1.0.9 — https://d3js.org/d3-path/
-- d3-sankey 0.12.3 — https://github.com/d3/d3-sankey
-- d3-shape 1.3.7 — https://d3js.org/d3-shape/
-- fast-uri 3.1.8 — https://github.com/fastify/fast-uri
-- qs 6.16.0 — https://github.com/ljharb/qs
-- rw 1.3.3 — https://github.com/mbostock/rw
-
-### EPL-2.0 (1)
-
-- elkjs 0.9.3 — https://github.com/kieler/elkjs#readme
-
-### ISC (40)
-
-- d3 7.9.0 — https://d3js.org
-- d3-array 3.2.4 — https://d3js.org/d3-array/
-- d3-axis 3.0.0 — https://d3js.org/d3-axis/
-- d3-brush 3.0.0 — https://d3js.org/d3-brush/
-- d3-chord 3.0.1 — https://d3js.org/d3-chord/
-- d3-color 3.1.0 — https://d3js.org/d3-color/
-- d3-contour 4.0.2 — https://d3js.org/d3-contour/
-- d3-delaunay 6.0.4 — https://github.com/d3/d3-delaunay
-- d3-dispatch 3.0.1 — https://d3js.org/d3-dispatch/
-- d3-drag 3.0.0 — https://d3js.org/d3-drag/
-- d3-dsv 3.0.1 — https://d3js.org/d3-dsv/
-- d3-fetch 3.0.1 — https://d3js.org/d3-fetch/
-- d3-force 3.0.0 — https://d3js.org/d3-force/
-- d3-format 3.1.2 — https://d3js.org/d3-format/
-- d3-geo 3.1.1 — https://d3js.org/d3-geo/
-- d3-hierarchy 3.1.2 — https://d3js.org/d3-hierarchy/
-- d3-interpolate 3.0.1 — https://d3js.org/d3-interpolate/
-- d3-path 3.1.0 — https://d3js.org/d3-path/
-- d3-polygon 3.0.1 — https://d3js.org/d3-polygon/
-- d3-quadtree 3.0.1 — https://d3js.org/d3-quadtree/
-- d3-random 3.0.1 — https://d3js.org/d3-random/
-- d3-scale 4.0.2 — https://d3js.org/d3-scale/
-- d3-scale-chromatic 3.1.0 — https://d3js.org/d3-scale-chromatic/
-- d3-selection 3.0.0 — https://d3js.org/d3-selection/
-- d3-shape 3.2.0 — https://d3js.org/d3-shape/
-- d3-time 3.1.0 — https://d3js.org/d3-time/
-- d3-time-format 4.1.0 — https://d3js.org/d3-time-format/
-- d3-timer 3.0.1 — https://d3js.org/d3-timer/
-- d3-transition 3.0.1 — https://d3js.org/d3-transition/
-- d3-zoom 3.0.0 — https://d3js.org/d3-zoom/
-- delaunator 5.1.0 — https://github.com/mapbox/delaunator#readme
-- inherits 2.0.4 — https://github.com/isaacs/inherits#readme
-- internmap 1.0.1 — https://github.com/mbostock/internmap/
-- internmap 2.0.3 — https://github.com/mbostock/internmap/
-- isexe 2.0.0 — https://github.com/isaacs/isexe#readme
-- once 1.4.0 — https://github.com/isaacs/once#readme
-- setprototypeof 1.2.0 — https://github.com/wesleytodd/setprototypeof
-- which 2.0.2 — https://github.com/isaacs/node-which#readme
-- wrappy 1.0.2 — https://github.com/npm/wrappy
-- zod-to-json-schema 3.25.2 — https://github.com/StefanTerdell/zod-to-json-schema#readme
-
-### MIT (216)
-
-- @antfu/install-pkg 2.1.0 — https://github.com/antfu-collective/install-pkg#readme
-- @braintree/sanitize-url 7.1.2 — https://github.com/braintree/sanitize-url#readme
-- @emoji-mart/data 1.2.1 — https://missiveapp.com/open/emoji-mart
-- @floating-ui/core 1.8.0 — https://floating-ui.com
-- @floating-ui/dom 1.8.0 — https://floating-ui.com
-- @floating-ui/react 0.27.20 — https://floating-ui.com/docs/react
-- @floating-ui/react-dom 2.1.9 — https://floating-ui.com/docs/react-dom
-- @floating-ui/utils 0.2.12 — https://floating-ui.com
-- @handlewithcare/prosemirror-inputrules 0.1.4
-- @hono/node-server 2.1.4 — https://github.com/honojs/node-server
-- @iconify/types 2.0.0 — https://github.com/iconify/iconify
-- @iconify/utils 3.1.7 — https://iconify.design/docs/libraries/utils/
-- @mantine/core 9.7.1 — https://mantine.dev/
-- @mantine/hooks 9.7.1 — https://mantine.dev
-- @mermaid-js/layout-elk 1.0.1 — https://github.com/mermaid-js/mermaid#readme
-- @mermaid-js/parser 2.0.1 — https://github.com/mermaid-js/mermaid/tree/develop/packages/mermaid/parser/#readme
-- @modelcontextprotocol/sdk 1.32.1 — https://modelcontextprotocol.io
-- @shikijs/types 4.5.0 — https://github.com/shikijs/shiki#readme
-- @shikijs/vscode-textmate 10.0.2 — https://github.com/shikijs/vscode-textmate#readme
-- @tiptap/core 3.31.4 — https://tiptap.dev
-- @tiptap/extension-bold 3.31.4 — https://tiptap.dev
-- @tiptap/extension-bubble-menu 3.31.4 — https://tiptap.dev
-- @tiptap/extension-code 3.31.4 — https://tiptap.dev
-- @tiptap/extension-floating-menu 3.31.4 — https://tiptap.dev
-- @tiptap/extension-italic 3.31.4 — https://tiptap.dev
-- @tiptap/extension-strike 3.31.4 — https://tiptap.dev
-- @tiptap/extension-text 3.31.4 — https://tiptap.dev
-- @tiptap/extension-underline 3.31.4 — https://tiptap.dev
-- @tiptap/extensions 3.31.4 — https://tiptap.dev
-- @tiptap/pm 3.31.4 — https://tiptap.dev
-- @tiptap/react 3.31.4 — https://tiptap.dev
-- @types/d3 7.4.3 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3
-- @types/d3-array 3.2.2 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-array
-- @types/d3-axis 3.0.6 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-axis
-- @types/d3-brush 3.0.6 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-brush
-- @types/d3-chord 3.0.6 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-chord
-- @types/d3-color 3.1.3 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-color
-- @types/d3-contour 3.0.6 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-contour
-- @types/d3-delaunay 6.0.4 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-delaunay
-- @types/d3-dispatch 3.0.7 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-dispatch
-- @types/d3-drag 3.0.7 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-drag
-- @types/d3-dsv 3.0.7 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-dsv
-- @types/d3-ease 3.0.2 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-ease
-- @types/d3-fetch 3.0.7 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-fetch
-- @types/d3-force 3.0.10 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-force
-- @types/d3-format 3.0.4 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-format
-- @types/d3-geo 3.1.1 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-geo
-- @types/d3-hierarchy 3.1.7 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-hierarchy
-- @types/d3-interpolate 3.0.4 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-interpolate
-- @types/d3-path 3.1.1 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-path
-- @types/d3-polygon 3.0.2 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-polygon
-- @types/d3-quadtree 3.0.6 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-quadtree
-- @types/d3-random 3.0.4 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-random
-- @types/d3-scale 4.0.9 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-scale
-- @types/d3-scale-chromatic 3.1.0 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-scale-chromatic
-- @types/d3-selection 3.0.12 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-selection
-- @types/d3-shape 3.2.0 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-shape
-- @types/d3-time 3.0.4 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-time
-- @types/d3-time-format 4.0.3 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-time-format
-- @types/d3-timer 3.0.2 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-timer
-- @types/d3-transition 3.0.9 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-transition
-- @types/d3-zoom 3.0.9 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-zoom
-- @types/geojson 7946.0.16 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/geojson
-- @types/hast 3.0.5 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/hast
-- @types/react 19.3.0 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react
-- @types/react-dom 19.3.0 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react-dom
-- @types/trusted-types 2.0.7 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/trusted-types
-- @types/unist 3.0.3 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/unist
-- @types/use-sync-external-store 0.0.6 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/use-sync-external-store
-- @types/use-sync-external-store 1.5.0 — https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/use-sync-external-store
-- @upsetjs/venn.js 2.0.0 — https://github.com/upsetjs/venn.js
-- accepts 2.0.0 — https://github.com/jshttp/accepts#readme
-- ajv 8.20.0 — https://ajv.js.org
-- ajv-formats 3.0.1 — https://github.com/ajv-validator/ajv-formats#readme
-- body-parser 2.3.0 — https://github.com/expressjs/body-parser#readme
-- bytes 3.1.2 — https://github.com/visionmedia/bytes.js#readme
-- call-bind-apply-helpers 1.0.2 — https://github.com/ljharb/call-bind-apply-helpers#readme
-- call-bound 1.0.4 — https://github.com/ljharb/call-bound#readme
-- clsx 2.1.1 — https://github.com/lukeed/clsx#readme
-- commander 7.2.0 — https://github.com/tj/commander.js#readme
-- commander 8.3.0 — https://github.com/tj/commander.js#readme
-- content-disposition 2.0.1 — https://github.com/jshttp/content-disposition#readme
-- content-type 1.0.5 — https://github.com/jshttp/content-type#readme
-- content-type 2.1.0 — https://github.com/jshttp/content-type#readme
-- cookie 0.7.2 — https://github.com/jshttp/cookie#readme
-- cookie-signature 1.2.2 — https://github.com/visionmedia/node-cookie-signature#readme
-- cors 2.8.6 — https://github.com/expressjs/cors#readme
-- cose-base 1.0.3 — https://github.com/iVis-at-Bilkent/cose-base#readme
-- cose-base 2.2.0 — https://github.com/iVis-at-Bilkent/cose-base#readme
-- cross-spawn 7.0.6 — https://github.com/moxystudio/node-cross-spawn
-- csstype 3.2.3 — https://github.com/frenic/csstype#readme
-- cytoscape 3.34.3 — http://js.cytoscape.org
-- cytoscape-cose-bilkent 4.1.0 — https://github.com/cytoscape/cytoscape.js-cose-bilkent
-- cytoscape-fcose 2.2.0 — https://github.com/iVis-at-Bilkent/cytoscape.js-fcose
-- dagre-d3-es 7.0.14 — https://github.com/tbo47/dagre-es#readme
-- dayjs 1.11.23 — https://day.js.org
-- debug 4.4.3 — https://github.com/debug-js/debug#readme
-- depd 2.0.0 — https://github.com/dougwilson/nodejs-depd#readme
-- detect-node-es 1.1.0 — https://github.com/thekashey/detect-node
-- dunder-proto 1.0.1 — https://github.com/es-shims/dunder-proto#readme
-- ee-first 1.1.1 — https://github.com/jonathanong/ee-first#readme
-- emoji-mart 5.6.0 — https://missiveapp.com/open/emoji-mart
-- encodeurl 2.0.0 — https://github.com/pillarjs/encodeurl#readme
-- es-define-property 1.0.1 — https://github.com/ljharb/es-define-property#readme
-- es-errors 1.3.0 — https://github.com/ljharb/es-errors#readme
-- es-object-atoms 1.1.2 — https://github.com/ljharb/es-object-atoms#readme
-- es-toolkit 1.52.0 — https://es-toolkit.dev
-- escape-html 1.0.3 — https://github.com/component/escape-html#readme
-- etag 1.8.1 — https://github.com/jshttp/etag#readme
-- eventsource 3.0.7 — https://github.com/EventSource/eventsource#readme
-- eventsource-parser 3.1.1 — https://github.com/rexxars/eventsource-parser#readme
-- express 5.3.0 — https://expressjs.com/
-- express-rate-limit 8.7.1 — https://github.com/express-rate-limit/express-rate-limit
-- fast-deep-equal 3.1.3 — https://github.com/epoberezkin/fast-deep-equal#readme
-- fast-equals 5.4.4 — https://github.com/planttheidea/fast-equals#readme
-- finalhandler 2.1.1 — https://github.com/pillarjs/finalhandler#readme
-- forwarded 0.2.0 — https://github.com/jshttp/forwarded#readme
-- fresh 2.0.0 — https://github.com/jshttp/fresh#readme
-- function-bind 1.1.2 — https://github.com/Raynos/function-bind
-- get-intrinsic 1.3.0 — https://github.com/ljharb/get-intrinsic#readme
-- get-nonce 1.0.1 — https://github.com/theKashey/get-nonce
-- get-proto 1.0.1 — https://github.com/ljharb/get-proto#readme
-- gopd 1.2.0 — https://github.com/ljharb/gopd#readme
-- hachure-fill 0.5.2 — https://github.com/pshihn/hachure-fill#readme
-- has-symbols 1.1.0 — https://github.com/ljharb/has-symbols#readme
-- hasown 2.0.4 — https://github.com/inspect-js/hasOwn#readme
-- hono 4.13.13 — https://hono.dev
-- http-errors 2.0.1 — https://github.com/jshttp/http-errors#readme
-- iconv-lite 0.6.3 — https://github.com/pillarjs/iconv-lite
-- iconv-lite 0.7.3 — https://github.com/pillarjs/iconv-lite
-- import-meta-resolve 4.2.0 — https://github.com/wooorm/import-meta-resolve#readme
-- ip-address 10.7.3 — https://github.com/beaugunderson/ip-address#readme
-- ipaddr.js 1.9.1 — https://github.com/whitequark/ipaddr.js#readme
-- is-promise 4.0.0 — https://github.com/then/is-promise#readme
-- jose 6.2.12 — https://github.com/panva/jose
-- json-schema-traverse 1.0.0 — https://github.com/epoberezkin/json-schema-traverse#readme
-- katex 0.16.47 — https://katex.org
-- khroma 2.1.0 — https://github.com/fabiospampinato/khroma#readme
-- layout-base 1.0.2 — https://github.com/iVis-at-Bilkent/layout-base#readme
-- layout-base 2.0.1 — https://github.com/iVis-at-Bilkent/layout-base#readme
-- lib0 1.0.0-rc.22 — https://github.com/dmonad/lib0#readme
-- lodash-es 4.18.1 — https://lodash.com/custom-builds
-- marked 16.4.2 — https://marked.js.org
-- math-intrinsics 1.1.0 — https://github.com/es-shims/math-intrinsics#readme
-- media-typer 1.1.1 — https://github.com/jshttp/media-typer#readme
-- merge-descriptors 2.0.0 — https://github.com/sindresorhus/merge-descriptors#readme
-- mermaid 12.1.0 — https://github.com/mermaid-js/mermaid#readme
-- mime-db 1.54.0 — https://github.com/jshttp/mime-db#readme
-- mime-types 3.0.2 — https://github.com/jshttp/mime-types#readme
-- ms 2.1.3 — https://github.com/vercel/ms#readme
-- negotiator 1.1.0 — https://github.com/jshttp/negotiator#readme
-- object-assign 4.1.1 — https://github.com/sindresorhus/object-assign#readme
-- object-inspect 1.13.4 — https://github.com/inspect-js/object-inspect
-- on-finished 2.4.1 — https://github.com/jshttp/on-finished#readme
-- orderedmap 2.1.1 — https://github.com/marijnh/orderedmap#readme
-- package-manager-detector 1.9.0 — https://github.com/antfu-collective/package-manager-detector#readme
-- parseurl 1.3.3 — https://github.com/pillarjs/parseurl#readme
-- path-data-parser 0.1.0 — https://github.com/pshihn/path-data-parser#readme
-- path-key 3.1.1 — https://github.com/sindresorhus/path-key#readme
-- path-to-regexp 8.4.2 — https://github.com/pillarjs/path-to-regexp#readme
-- pkce-challenge 5.0.1 — https://github.com/crouchcd/pkce-challenge#readme
-- points-on-curve 0.2.0 — https://github.com/pshihn/bezier-points#readme
-- points-on-path 0.2.1 — https://github.com/pshihn/points-on-path#readme
-- prosemirror-changeset 2.4.4
-- prosemirror-commands 1.7.2
-- prosemirror-dropcursor 1.8.4
-- prosemirror-gapcursor 1.4.1 — https://github.com/prosemirror/prosemirror-gapcursor#readme
-- prosemirror-highlight 0.15.3 — https://github.com/ocavue/prosemirror-highlight#readme
-- prosemirror-history 1.5.1
-- prosemirror-inputrules 1.5.1 — https://github.com/prosemirror/prosemirror-inputrules#readme
-- prosemirror-keymap 1.2.3 — https://github.com/prosemirror/prosemirror-keymap#readme
-- prosemirror-model 1.25.12
-- prosemirror-schema-list 1.5.1 — https://github.com/prosemirror/prosemirror-schema-list#readme
-- prosemirror-state 1.4.4 — https://github.com/prosemirror/prosemirror-state#readme
-- prosemirror-tables 1.8.5 — https://github.com/ProseMirror/prosemirror-tables#readme
-- prosemirror-transform 1.12.2
-- prosemirror-view 1.42.6
-- proxy-addr 2.0.8 — https://github.com/jshttp/proxy-addr#readme
-- range-parser 1.3.0 — https://github.com/jshttp/range-parser#readme
-- raw-body 3.0.2 — https://github.com/stream-utils/raw-body#readme
-- react 19.3.0 — https://react.dev/
-- react-dom 19.3.0 — https://react.dev/
-- react-number-format 5.4.5 — https://s-yadav.github.io/react-number-format/docs/intro
-- react-remove-scroll 2.7.2 — https://github.com/theKashey/react-remove-scroll#readme
-- react-remove-scroll-bar 2.3.8 — https://github.com/theKashey/react-remove-scroll-bar#readme
-- react-style-singleton 2.2.3 — https://github.com/theKashey/react-style-singleton#readme
-- require-from-string 2.0.2 — https://github.com/floatdrop/require-from-string#readme
-- rope-sequence 1.3.4 — https://github.com/marijnh/rope-sequence#readme
-- roughjs 4.6.6 — https://roughjs.com
-- router 2.2.0 — https://github.com/pillarjs/router#readme
-- safer-buffer 2.1.2 — https://github.com/ChALkeR/safer-buffer#readme
-- scheduler 0.28.0 — https://react.dev/
-- send 1.2.1 — https://github.com/pillarjs/send#readme
-- serve-static 2.2.1 — https://github.com/expressjs/serve-static#readme
-- shebang-command 2.0.0 — https://github.com/kevva/shebang-command#readme
-- shebang-regex 3.0.0 — https://github.com/sindresorhus/shebang-regex#readme
-- side-channel 1.1.1 — https://github.com/ljharb/side-channel#readme
-- side-channel-list 1.0.1 — https://github.com/ljharb/side-channel-list#readme
-- side-channel-map 1.0.1 — https://github.com/ljharb/side-channel-map#readme
-- side-channel-weakmap 1.0.2 — https://github.com/ljharb/side-channel-weakmap#readme
-- statuses 2.0.2 — https://github.com/jshttp/statuses#readme
-- stylis 4.4.0 — https://github.com/thysultan/stylis.js
-- tabbable 6.5.0 — https://github.com/focus-trap/tabbable#readme
-- tagged-tag 1.0.0 — https://github.com/sindresorhus/tagged-tag#readme
-- tinyexec 1.3.1 — https://github.com/tinylibs/tinyexec#readme
-- toidentifier 1.0.1 — https://github.com/component/toidentifier#readme
-- ts-dedent 2.3.0 — https://github.com/tamino-martinius/node-ts-dedent#readme
-- type-is 2.1.0 — https://github.com/jshttp/type-is#readme
-- unpipe 1.0.0 — https://github.com/stream-utils/unpipe#readme
-- use-callback-ref 1.3.3 — https://github.com/theKashey/use-callback-ref#readme
-- use-sidecar 1.1.3 — https://github.com/theKashey/use-sidecar
-- use-sync-external-store 1.6.0 — https://github.com/facebook/react#readme
-- uuid 14.0.3 — https://github.com/uuidjs/uuid#readme
-- vary 1.1.2 — https://github.com/jshttp/vary#readme
-- w3c-keyname 2.2.8 — https://github.com/marijnh/w3c-keyname#readme
-- zod 4.6.5 — https://zod.dev
-
-### MPL-2.0 (3)
-
-- @blocknote/core 0.55.0 — https://github.com/TypeCellOS/BlockNote
-- @blocknote/mantine 0.55.0 — https://github.com/TypeCellOS/BlockNote
-- @blocknote/react 0.55.0 — https://github.com/TypeCellOS/BlockNote
-
-### OFL-1.1 (1)
-
-- @fontsource/ia-writer-mono 5.3.0 — https://fontsource.org/fonts/ia-writer-mono
-
-### Unlicense (1)
-
-- robust-predicates 3.0.3 — https://github.com/mourner/robust-predicates#readme
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index c696ade..b848733 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -11,7 +11,7 @@
     "preview": "electron-vite preview",
     "e2e": "electron-vite build && playwright test",
     "e2e:real": "electron-vite build && playwright test -c playwright.real.config.ts",
-    "prepack": "node ../../scripts/fetch-tectonic.mjs && node node_modules/electron/install.js && pnpm --filter @lucid/mcp bundle && electron-vite build",
+    "prepack": "node ../../scripts/notices.mjs && node ../../scripts/fetch-tectonic.mjs && node node_modules/electron/install.js && pnpm --filter @lucid/mcp bundle && electron-vite build",
     "dist": "pnpm prepack && electron-builder --publish never",
     "e2e:packaged": "playwright test -c playwright.packaged.config.ts",
     "dist:dir": "pnpm prepack && electron-builder --dir"
diff --git a/package.json b/package.json
index 242bad3..dc9ae41 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,6 @@
     "ci": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm test",
     "mcp:build": "pnpm --filter @lucid/mcp bundle",
     "notices": "node scripts/notices.mjs",
-    "notices:check": "node scripts/notices.mjs --check",
     "eval": "node packages/evals/scripts/eval.mjs",
     "dist": "pnpm --filter @lucid/desktop dist",
     "e2e:packaged": "pnpm --filter @lucid/desktop e2e:packaged",
diff --git a/scripts/notices.mjs b/scripts/notices.mjs
index 2dfdfdc..ab3200c 100644
--- a/scripts/notices.mjs
+++ b/scripts/notices.mjs
@@ -1,12 +1,14 @@
 import { execFileSync } from "node:child_process";
-import { readFileSync, writeFileSync } from "node:fs";
+import { writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 /**
  * Writes THIRD_PARTY_NOTICES.md from the production dependencies pnpm installed: `node scripts/notices.mjs`.
- * `--check` fails when the file is out of date (run it after changing dependencies).
+ * The file comes with the packaged app (Help, Third-party notices), because the licenses of what is bundled ask for it; it is
+ * made when the app is packaged (`prepack`) and is not kept in the repository.
  */
-const OUT = fileURLToPath(new URL("../THIRD_PARTY_NOTICES.md", import.meta.url));
+const ROOT = fileURLToPath(new URL("..", import.meta.url));
+const OUT = `${ROOT}THIRD_PARTY_NOTICES.md`;
 
 // A license pnpm cannot read from a package, checked by hand against the package's own repository.
 const KNOWN = { khroma: "MIT" };
@@ -14,6 +16,9 @@ const KNOWN = { khroma: "MIT" };
 const raw = execFileSync("pnpm", ["licenses", "list", "--prod", "--json"], {
   encoding: "utf8",
   maxBuffer: 50_000_000,
+  cwd: ROOT,
+  // On Windows pnpm is a .cmd file, which only a shell can start.
+  shell: process.platform === "win32",
 });
 const byLicense = JSON.parse(raw);
 
@@ -58,20 +63,5 @@ for (const [lic, list] of groups) {
 }
 const text = `${lines.join("\n")}\n`;
 
-if (process.argv.includes("--check")) {
-  const current = (() => {
-    try {
-      return readFileSync(OUT, "utf8");
-    } catch {
-      return "";
-    }
-  })();
-  if (current !== text) {
-    console.error("THIRD_PARTY_NOTICES.md is out of date. Run: node scripts/notices.mjs");
-    process.exit(1);
-  }
-  console.log("THIRD_PARTY_NOTICES.md is up to date.");
-} else {
-  writeFileSync(OUT, text);
-  console.log(`wrote ${OUT} (${String(rows.length)} packages)`);
-}
+writeFileSync(OUT, text);
+console.log(`wrote ${OUT} (${String(rows.length)} packages)`);
diff --git a/site/index.html b/site/index.html
index e7f036f..2e7a76d 100644
--- a/site/index.html
+++ b/site/index.html
@@ -1014,9 +1014,7 @@ <h2>Good to know.</h2>
             <a href="https://github.com/triggeredcode/lucid/blob/main/SECURITY.md">Security</a>
           </li>
           <li>
-            <a href="https://github.com/triggeredcode/lucid/blob/main/THIRD_PARTY_NOTICES.md"
-              >Licences</a
-            >
+            <a href="https://github.com/triggeredcode/lucid/blob/main/LICENSE">Licences</a>
           </li>
         </ul>
       </div>